What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Ieed Help With A Persistent Bug That

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I have a problem that I tried to use Spybot S&D but that didnt work (or more accurately i coulednt get on the internet until i restored all that spybot took out). I posted on www.majorgeeks and it was suggested I try hijack this. Then I ws told I have "looktome" and followed those instructions to post my log here. I am a novice in forums like this and even more a novice at trying to repair my comoputer so please give me easy steps to follow. It was pointed out that when I am done with this i should update my XP and my IE and I will do that.

One of the things happening is a Tool bar that opens up any time I use IE that loks at allaboutsearching.com bevfore the webbsite my browser is requesting

Thanks for your help it is greatly appreciated



Logfile of HijackThis v1.97.7
Scan saved at 12:30:24 AM, on 4/8/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\wmagluebody\poll exit.exe
C:\Program Files\AOL Companion\companion.exe
C:\RECYCLER\NPROTECT\00010365.EXE
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://allaboutsearching.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://allaboutsearching.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allaboutsearching.com/passthrough/i…eberbullet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://allaboutsearching.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://allaboutsearching.com/searchbar.html
O1 - Hosts: Nu_>
O1 - Hosts: ˜‘x‘
O1 - Hosts:
O1 - Hosts:
Post #2 last edited
ok well i ws referred here by someone on majorgeeks.com and they told me to go ahead and update my browser and windows while wiating for a response. I did that but now cannot conenct to the internet at all from that computer (thank goodness I have another in the house) Whenever I open IE now i get an error message but my computer first trys to "passthru" allabout searching.com and opens what appears to be a tool bar at the bottom of the screen but shows up on my tool bar as an additional IE window?? I tried xpwinsock repair but it didnt seem to help. Any thoughts? Thanks for your help
Post #3 last edited
Create a new folder called C:\HijackThis, extract the HijackThis.exe file from the zip file into the new folder and run it from there. This is necessary to ensure you have backups should anything go wrong.

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://allaboutsearching.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://allaboutsearching.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allaboutsearching.com/passthrough/i…eberbullet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://allaboutsearching.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://allaboutsearching.com/searchbar.html
O1 - Hosts: Nu_>
O1 - Hosts: ˜‘x‘
O1 - Hosts:
O1 - Hosts:
Post #4
Followed your steps but when i went to check the box to the left on "Hijack This "none of the entrys for 01- Hosts were there.

I had run version 1.04 of kill2me earlier in the day after i had posted my log (as I was advised to by the guy on majorgeeks who referred me here)


Everything you wanted gone appears gone but I still cannot seem to get my IE to work right as I cannot reach the internet from the computer.

I am very happy about losing "allabout searching" but Can you assist me in getting IE back.

One other note you said delete the folder wmagluebody which I did by putting it in my norton protected trash (the only way i know hoe to delete something) is there aanother way I should have deleted it?

Thank you again for your assistance.


Heres the way my log looks now:

Logfile of HijackThis v1.97.7
Scan saved at 11:34:46 PM, on 4/8/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\HJT\hijackthis\HijackThis.exe
C:\HJT\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virtualweberbullet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\SpyHunter\SpyHunter.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: MoneySide (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - http://toolbar.isearch.com/general/drm.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.140/code/PWActiveXImgCtl.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac…ta/SymAData.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/BM2/BM2.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac…/ActiveData.cab
Post #5
Click here to download WinsockFix. Save it on a floppy and then transfer it to the hard disk of the affected computer. Extract the file from the zip and double click it to run it. Let us know if it helps with the internet access.
Post #6
No luck, tried winsockfix but it did not restore internet connection. It dosent even time out looking but goes right away to a "cannot find server" screen Thanks again
Post #8
Locate the hosts file (no extension,just Hosts) in C:\Windows\System32\Drivers\Etc. Single left click to select. Hold shift key and right click and choose open with Choose notepad, but make sure always use is not checked. Click okay. Copy the contents (save as hosts.txt) Delete all contents of this file. Choose save as "Hosts" with the quotes and all files selected in file types (reopen to make sure it is empty) Then go to start/ run and type cmd hit enter and in black box type ipconfig /flushdns hit enter Try again to connect. I suspect there is an invisible java redirect in your hosts file. I forget what you type in the IE address bar to test it, but this should clear it. (your internet connection connects, just that web browsers etc do not right? Does email work or anything?)
Post #9
ok located host files without extension and did as was directed but still no internet connection What a bummer this is really starting to drag on me Any other ideas?
Post #10

(your internet connection connects, just that web browsers etc do not right? Does email work or anything?)

Could you respond to comvayk9's question?

Also could you tell us exactly what you were doing (or removing) that broke the connection?
Post #11 last edited
I had tried to use Spybot S&D & adaware to clear up this problem and when I did lost the internet connection (by using spybot nto adaware) It was after that I went to Majorgeeks and they recommended cws shredder and kill2me unfortunately there was a ton that spybot had picked up so I do nto know what specifically did it. (except i could get into AOL with no buddy list but mail was accessable/ websites were not) We are in the processing of dupming AOL so since I'm trying to clean up this computer I removed AOL so I dont have a ay to go back and see if AOL is still accessable. I had restored all the stuff that spybot took off and got the connection back but that was before hijack this and the internet connection wasnt restored by reversing the spybot fixes (tried that sthe day I lost the connection) Sorry to be a pain and I am thankful for your assisctance.
Post #13
Could you clarify:

You are able to get online, but Internet Explorer isn't working, other online activities like email are unaffected?

You tried the WinsockFix from the link I provided?

Sorry to go over this but it is important. One other thing, click here to download LSPFix. Extract the program from the zip file and run it. Let me know what files are listed in each of the two windows.
Post #14
You may consider this case solved or fixed. Teh connection p[roblem turned out to be related to my in home network . I contacted my ISP (cable company) who said my IP for this computer was invalid and directed me to my wireless router company (DLINK) called tech support and figured out that the dlink utility disabled teh windows utility. The Dlink utility had become damaged and that left me with no program to manage my wireless connection from that computer Thank you so much for you help I am very greatful for the assistance. I have one other computer that I am suspicious has some crap on it and am going to taka look at it now. Your assistance has been invaluable as you did help me get the nasty bugs out of that computer and additionally i learned a bunch. thank you to be through I did run your LSPfix and nothing was on the right windw and when I clicked finish it did no repairs
Post #15
You're welcome - glad to help :D

As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI